Hi All, using below query but not getting complete output.
If there is no data present for Response time for particular days but values present for Fordresponsetime for same days it is not showing up in the table
|tstats avg(TotalResponseTime) as ResponseTime avg(FordResponseTime) as Fordresponsetime where index=app-index NOT TERM(timeout) by _time
QueryOutput:
| _time | ResponseTime | Fordresponsetime |
| 2024-01-01 | 12.67 | 34.00 |
| 2024-01-02 | 34.94 | 56.89 |
| 2024-01-03 | 24.78 | 52.70 |
| 2024-01-04 | 34.70 | 42.87 |
ExpectedOutput:
| _time | ResponseTime | Fordresponsetime |
| 2024-01-01 | 12.67 | 34.00 |
| 2024-01-02 | 34.94 | 56.89 |
| 2024-01-03 | 24.78 | 52.70 |
| 2024-01-04 | 34.70 | 42.87 |
| 2024-01-05 | 0 | 33.56 |
| 2024-01-06 | 0 | 23.77 |
| 2024-01-07 | 0 | 34.78 |
The stats family of commands will not fill in the null values created by the absence of data. The timechart command, however, will do so. try this
|tstats prestats=t avg(TotalResponseTime) as ResponseTime avg(FordResponseTime) as Fordresponsetime where index=app-index NOT TERM(timeout) by _time
| timechart avg(TotalResponseTime) as ResponseTime avg(FordResponseTime) as FordresponsetimeThe tstats command does the heavy lifting and prepares the results for later processing by another stats command. The timechart command essentially formats what tstats created and fills in zeroes for missing values.